Phoenix Contact CHARX: Credentials in Logs Open EV Charging Stations to Attack

On July 30, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-506, documenting a vulnerability in the Phoenix Contact CHARX SEC-3150 industrial charger. The flaw, cataloged as CVE-2026-44105, allows a network-adjacent attacker to retrieve credentials from log files and bypass authentication. The discovery, presented in the Pwn2Own context, highlights an overlooked issue in the convergence of IT and operational security: diagnostic logs, traditionally considered harmless, can become the weakest link in critical infrastructure.

The Mechanism: From Readable Logs to SSH Access

The flaw resides in the CHARX SEC-3150 firmware's log generation component. According to the ZDI advisory, "the specific flaw exists within the generation of log files. The issue results from including sensitive information in a log file." The CVE Record CVE-2026-44105, published on cve.org, states that "the credentials for the local user 'user-app' may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user 'user-app'."

There is tension between these two descriptions that the dossier does not fully resolve. The ZDI advisory indicates a "network-adjacent" attacker for whom "authentication is not required to exploit this vulnerability," while the CVE Record specifies a "low-privileged local attacker with access to the logs." The attack matrices are not perfectly aligned: network-adjacent typically implies the same local network segment, while local requires filesystem access. The brief does not clarify whether log access occurs via a network protocol (remote syslog, download via web interface) or requires presence on the device.

What is documented is the functional chain. Credentials end up in logs. Someone with the ability to read those logs extracts them. With those credentials, they authenticate via SSH as the "user-app" user, which the CVE Record defines as a "limited user." It is not an administrator, but unauthorized access to an industrial charging device opens concrete operational options: the CVE Record explicitly mentions that "charging could be interrupted."

A Score That Hides the Risk Geometry

Severity is MEDIUM on both scales. The ZDI published list indicates CVSS 5.3, while the official CVE Record reports CVSS 3.1: 6.6 and CVSS 4.0: 5.8. The brief records no conflict between these sources: the scores are consistent with the MEDIUM band but measure slightly different dimensions of the same vulnerability. The CVE Record, the authoritative primary source for scoring, provides the more detailed vector: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H in CVSS 3.1, which translates to local attack, low complexity, low privileges required, no user interaction, unchanged scope, limited impact on confidentiality and integrity, but high on availability.

The A:H (high availability) data point is significant for context. An industrial charger in a public charging station, a fleet hub, or a logistics infrastructure is not a generic server: its unavailability translates directly into interruption of charging service, with impacts on operational continuity and, potentially, on service level agreement contracts. The overall medium score does not capture this asymmetry between standard IT impact and industrial operational impact.

"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability."
— Advisory ZDI-26-506

Pwn2Own as a Thermometer for an Immature Sector

The vulnerability was presented in the Pwn2Own context, the competition program that rewards zero-day exploits on selected hardware and software categories. The presence of an EV charger in this arena is telling: the industrial electric charging sector is going through the same security maturation phase that traditional automotive, consumer IoT, and industrial control systems have already faced. Devices designed to withstand extreme environmental conditions, with long lifecycles and complex firmware updates, often accumulate technical debt in dimensions not visible in datasheets.

The researchers who discovered the flaw — Nabih Benazzouz, Julien Cohen-Scali, Hugo Leclercq, and Patrick Ventuzelo, all affiliated with Fuzzinglabs — likely identified the issue through firmware analysis and fuzzing techniques. The timeline is known: reported to the vendor on February 9, 2026, coordinated release on July 30, 2026. Five months of coordinated disclosure, a standard period that, in a sector with complex firmware supply chains, can translate into a prolonged exposure window for already-deployed devices.

Immediate Actions

Firmware v1.9.1 fixes the vulnerability and is available by August 12, 2026, according to the ZDI advisory. Priority actions for charging infrastructure operators, fleet managers, and industrial integrators are fourfold.

First: verify the installed firmware version on all CHARX SEC-3150 devices in the fleet. The model is explicitly identified in the advisory; verification must be device-by-device.

Second: plan the update to firmware v1.9.1 in the nearest possible maintenance window to the availability date. The advisory does not indicate automatic distribution; the action requires programmatic intervention.

Third: restrict access to device log files to authenticated and authorized entities, compatible with existing network architecture. The brief does not specify whether logs are accessible via network or only locally; absent this information, generalized restriction is prudent.

Fourth: monitor SSH accesses using the "user-app" credentials on devices that cannot be updated immediately. This user is explicitly cited by the CVE Record as the post-exploitation access vector.

The Remaining Gap

The dossier provides no information on three relevant operational questions. The number of CHARX SEC-3150 devices deployed globally, or the percentage receiving automatic updates, is unknown. The presence of a public exploit or proof-of-concept outside the Pwn2Own context is not documented. It is not confirmed that firmware v1.9.1 was actually released by August 12, 2026 — the date, at the time of writing, is future relative to the advisory.

These gaps do not diminish the relevance of the report. Rather, they place it in a broader context: the electric charging industry is building infrastructure that will be in the field for decades, with security requirements evolving faster than hardware lifecycles. A charger that exposes credentials in logs is a symptom of a diagnostic approach inherited from traditional IT, applied to a domain where operational consequences are different and often more severe. Fixing the specific defect is technically simple; building a security culture that draws this boundary is the larger problem.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-506/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-44105
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html

Information verified against cited sources and current as of publication.

Sources